CVE-2026-109675

Received Received - Intake

Broken Access Control in Frappe Suite

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109675

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	suite	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f allows authenticated mail users to access other users' data through broken access control in the get_mailboxes and get_quota APIs. Attackers can use another user's JMAP account ID to view mailbox names, message counts, automation rules with sender addresses, and storage quota usage.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to your email data, including mailbox names, message counts, and storage usage. Attackers with your JMAP account ID could gather sensitive information about your email activity and storage habits.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and potentially HIPAA's privacy rules if healthcare-related emails are exposed. It may result in non-compliance with data protection regulations.

Mitigation Strategies

Update Frappe Suite to the latest commit or version that fixes the broken access control issue in the get_mailboxes and get_quota APIs. Ensure proper authentication and authorization checks are enforced for all API endpoints.

Hi! I’m here to help you understand CVE-2026-109675. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70